Licenses, external users and self-service password reset

In lesson 1.1 you created users and groups. Today is about three things that hang on those accounts: licenses, which entitle them to something; guests from outside, who get access to individual things; and the option for users to reset a forgotten password themselves.

Nordlicht Reisen GmbH, a fictional travel agency, has three cases for this. The booking team needs licenses for services that require one. A partner agency is supposed to view a document without IT creating an account for every person. And the hotline is not supposed to reset passwords every Monday.

Prior knowledge: External identities (B2B collaboration) and the tiers of Microsoft Entra ID are explained in "AZ-900 compact", lesson 2.6. Creating groups and users is covered in lesson 1.1; classifying license tiers and passwords is in K3, lesson 3.1.4. This lesson shows the administration.

Managing licenses

Some services are usable only once a license is assigned to the user. Which features a license unlocks depends on the product. Three rules apply to administration.

The location comes first. Not every Microsoft service is available in every country. Before a user can get a license, they need a location (usage location). You set it when you create the user under Settings, or later in the user's properties (lesson 1.1). With group licenses, users without a location of their own inherit the tenant's location.

Who may assign licenses? At least the License Administrator, User Administrator or (for groups) Groups Administrator role.

The path in the portal. For a single user: in the Entra admin center under Billing, Licenses, choose the product, Assign, choose the user under Users and groups, switch the desired services on or off under Assignment options, then Assign. Depending on the interface, the page is also called Identity > Billing > Licenses; the names in the portal change. You can also assign licenses in the Microsoft 365 admin center.

For scripts there is the Microsoft Graph PowerShell SDK (not the Az module). An example from the documentation:

$e5Sku = Get-MgSubscribedSku -All | Where SkuPartNumber -eq 'SPE_E5'
Set-MgUserLicense -UserId "belindan@litwareinc.com" -AddLicenses @{SkuId = $e5Sku.SkuId} -RemoveLicenses @()

Get-MgSubscribedSku lists the products the tenant has bought; Set-MgUserLicense adds a license and removes none. The location is set by Update-MgUser -UserId <name> -UsageLocation <country code>. An account without a license does not have the services; whoever deletes an account releases its license immediately.

Licenses through groups

Instead of assigning a license to each user individually, you assign it to a group (group-based licensing): every member gets it automatically and loses it when leaving. This works with security groups, mail-enabled groups and Microsoft 365 groups. The limits Microsoft names:

• Nested groups are not supported. If you assign the license to a group that contains other groups, only the users on the first level get the license.
• In the Microsoft 365 admin center, licenses can be assigned to at most 20 groups at once.
• With very large groups, license changes can take a long time.

When you move users between two licensed groups, you add them to the new group first, check on the user's page that the new license is there, and then remove them from the old one. If you remove first, the user is without a license until the processing of the new one is finished.

Interpreting license errors

With group licenses, an error does not appear right away but later on the user. You find it in the portal on the product's page under Errors & issues, or when you open the group. The most common cases:

After the correction, you choose the group or the user under Errors & issues and then Reprocess. Reprocessing covers at most 20 users at once.